Given what a dumpster fire npm ecosystem is security wise, it's best to run the whole build chain in a container anyway, at least for frontend apps. This way you also don't care about the chosen package manager or node.js version - you can just set it as you wish in the Dockerfile. It does take more disk space though, but to me it's a nice compromise.
Containers don't provide much protection from malware, unless you're running it rootless under an unprivileged user (no sudo access, no ssh keys or anything else interesting in the home directory, etc; and even then it's limited because the attack surface is enormous).
I mean, of course? Especially, why would I put ssh keys and similar in the container?
This still doesn't mean that one can install just any package, but it does make it much more difficult for it to do much harm. Breaking out of a container is not as trivial as it once was. That said, it is not a perfect solution, so I'd be happy to hear of better ones. Any suggestions?
No ssh keys or anything else interesting available to the user you're running the container engine under (and containers themselves). Not the user _inside_ the container, but on the main system.
We used to be on Zoom for video meetings, then it lost favor due to fears of industrial espionage (the encryption crisis, etc.) and via Office 365, Teams snuck up. Initially as a Zoom replacement only for video meetings, too, but lately folks seem to be discovering the other functionality and it's creeping in.
Zoom's ugly as hell, but the Linux client has long been fairly reliable. Teams meanwhile is plagued by issues that don't seem to affect some other Electron-based apps or Chromium. During meetings it'll start out fine, then a minute in it'll suddenly use microphone. Opening any settings views tends to knock audio out of working state, too. Their official forums are full of threads on this, and support people suggesting crazy mitigations such as running it as root (admin user).
The most recent release seems to be from September 2021, which is positively ancient for something based on a browser engine and using it to display complex content from remote hosts.
It will come. FB is investing the big bucks but once they start seeing real success (and they are) others will see the value and start competing for real.
Me too. Had to go back to Windows at $JOB recently and find the experience... unpleasant, to put it mildly. I guess once you get used to a certain way it's difficult to change it. Hoping to get rid of Windows again soon. Can't imagine using W11, from what I've seen.
